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Robust digital token generation and verification system accommodating token verification 
where addressee information cannot be recreated in automated mail processing 



(57) A method for generating evidencing informa- 
tion for a document includes generating an error correc- 
tion code and generating a digital token employing the 
error correction code. A method for verifying authentica- 
tion and integrity information printed on a mail piece 
includes obtaining an error correction code printed on 
the document and employing the obtained error correc- 
tion code to verify the validity of the evidencing informa- 
tion. A method for verifying the evidencing information 
printed on a mail piece includes obtaining an error cor- 
rection code printed on a mail piece and determining 



that the obtained error correction code is inaccurate. 
The information employed to generate the inaccurate 
error correction code is obtained and an error correction 
code is generated from the obtained information. The 
generated error correction code is employed to verify 
the validity of the evidencing information. The document 
may be a mail piece and the evidencing information 
postage evidencing information with the error correction 
code being for at least a portion of destination address 
information. 
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Description 

[0001] The present invention relates to providing a 
more efficient processing system with enhanced secu- 
rity by enabling verification of digital tokens where nec- 
essary information may not be readable, even when the 
reading is assisted with the use of conventional error 
correction codes. More particularly, the present inven- 
tion relates to robust mail piece digital token verification 
systems, increasing the percentage of mail pieces 
where token verification can be achieved, even where 
full addressee information may not be able to be recre- 
ated, and with enhanced ability to automatically read 
addressee block information by providing on each mail 
piece information concerning the address block struc- 
ture. 

[0002] Postage metering systems print and account 
for postage and other unit value printing such as parcel 
delivery service charges and tax stamps. These sys- 
tems have been both electronic and mechanical. Some 
of the varied types of postage metering systems are 
shown, for example, in US Patent No. 3,978,457 for 
MICROCOMPUTERIZED ELECTRONIC POSTAGE 
METER SYSTEM, issued August 31, 1976; US Patent 
No. 4,301,507 for ELECTRONIC POSTAGE METER 
HAVING PLURAL COMPUTING SYSTEMS, issued 
November 17, 1981; and, US Patent No. 4,579,054 for 
STAND ALONE ELECTRONIC MAILING MACHINE, 
issued April 1, 1986. Moreover, other types of metering 
systems have been developed which involve different 
printing systems such as those employing thermal print- 
ers, ink jet printers, mechanical printers and other types 
of printing technologies. Examples of these other types 
of electronic postage meter are described in US Patent 
No. 4,168,533 for MICROCOMPUTER MINIATURE 
POSTAGE METER, issued September 18, 1979; and, 
US Patent No. 4,493,252 for POSTAGE PRINTING 
APPARATUS HAVING A REMOVABLE PRINT HEAD 
AND A PRINT DRUM, issued January 15, 1985. These 
printing systems enable the postage meter system to 
print variable information which may be alphanumeric 
and graphic type of information. 
[0003] Card controlled metering systems have also 
been developed. These systems have employed both 
magnetic strip type cards and microprocessor based 
cards. Examples of card controlled metering systems 
employing magnetic type cards include US Patent No. 
4,222,518 for METERING SYSTEM, issued September 
16, 1980; US Patent No. 4,226,360 for METERING 
SYSTEM, issued October 7, 1980; and, US Patent No. 
4,629,871 for ELECTRONIC POSTAGE METER SYS- 
TEM SETTABLE BY MEANS OF A REMOTELY GEN- 
ERATED INPUT DEVICE, issued December 16, 1986. 
A microprocessor ("smart card") based card metering 
system providing an automated transaction system 
employing microprocessor bearing user cards issued to 
respective users is disclosed in US Patent No. 
4,900,903 for AUTOMATED TRANSACTION SYSTEM 



WITH INSERTABLE CARDS FOR TRANSFERRING 
ACCOUNT DATA, issued February 13, 1990. Moreover, 
systems have also been developed wherein a unit hav- 
ing a non-volatile read/write memory which may consist 

5 of a EEPROM is employed. One such system is dis- 
closed in US Patent No. 4,757,532 for SECURE 
TRANSPORT OF INFORMATION BETWEEN ELEC- 
TRONIC STATIONS, issued July 12, 1988 and US Pat- 
ent No. 4,907,271 for SECURE TRANSMISSION OF 

w INFORMATION BETWEEN ELECTRONIC STATIONS, 
issued March 6, 1990. 

[0004] Postage metering systems have also been 
developed which employ encrypted information printed 
on a mail piece. The postage value for a mail piece may 

15 be encrypted together with other data to generate a dig- 
ital token. A digital token is encrypted information that 
authenticates and enables verification of the integrity of 
the information imprinted on a mail piece including post- 
age values. Examples of postage metering systems 

so which generate and employ digital tokens are described 
in US Patent No. 4,757,537 for SYSTEM FOR 
DETECTING UNACCOUNTED FOR PRINTING IN A 
VALUE PRINTING SYSTEM, issued July 12, 1988; US 
Patent No. 4,831,555 for SECURE POSTAGE APPLY- 

25 ING SYSTEM, issued May 16, 1989; US Patent No. 
4,775,246 for SYSTEM FOR DETECTING UNAC- 
COUNTED FOR PRINTING IN A VALUE PRINTING 
SYSTEM, issued October 4, 1988; US Patent No. 
4,873,645 for SECURE POSTAGE DISPENSING SYS- 

30 TEM, issued October 10, 1989; and, US Patent No. 
4,725,718 for POSTAGE AND MAILING INFORMA- 
TION APPLYING SYSTEM, issued February 16, 1988 
and the system disclosed in the various United States 
Postal Service published specifications such as Infor- 

35 mation Based Indicium Program Key Management Sys- 
tem Plan, dated April 25, 1997; Information Based 
Indicia Program (IBIP) Open System Indicium Specifi- 
cation, dated July 23, 1997; Information Based Indicia 
Program Host System Specification dated October 9, 

40 1996, and Information Based Indicia Program (IBIP) 
Open System Postal Security Device (PSD) Specifica- 
tion dated July 23, 1997. 

[0005] These systems, which may utilize a device 
termed a postage evidencing device (PED), employ an 
45 encryption algorithm to encrypt selected information to 
generate the digital token. The encryption of the infor- 
mation provides security to prevent altering of the 
printed information in a manner such that any change in 
the values printed in the postal revenue block is detect- 
so able by appropriate verification procedures. 

[0006] Typical information which may be encrypted as 
part of the input to a digital token includes the value of 
the imprint, the origination zip code, the recipient 
addressee information (such as, for example, delivery 
55 point destination code), the date and a serial piece 
count number. These items of information when 
encrypted with a secret or private key and imprinted on 
a mail piece provide a very high level of security which 
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enables the detection of any attempted modification of 
the information in the postal revenue block, where this 
information may be imprinted both in encrypted and 
unencrypted form. These digital token systems can be 
utilized with both a dedicated printer, that is, a printer 5 
that is securely coupled to an accounting module such 
that printing cannot take place without accounting or in 
systems employing non-dedicated printers and secure 
accounting system. In this case, such as in personal or 
(wide area or local area) network computing systems, w 
the non-dedicated printer may print the digital token as 
well as other information. 

[0007] Digital tokens need to be computed and 
printed, for example, in the postal revenue block for 
each mail piece. The digital token transformation (DTT) is 
computation requires a secret or private key, that has to 
be protected and may be periodically updated. One of 
the more difficult problems with encrypted evidence of 
postage payment is the key management problem. 
Indeed, the use two digital tokens (postal and vendor) is 20 
described in pending US Patent No. 5,390,251 for MAIL 
PROCESSING SYSTEM INCLUDING DATA CENTER 
VERIFICATION FOR MAILPIECES, issued February 
14, 1995, the entire disclosure of which is hereby incor- 
porated by reference. In such systems, the digital 25 
tokens are usually computed for every mail piece proc- 
essed. This computation involves taking input data such 
as serial piece count, date, origination postal code and 
postage amount and encrypting this data with secret 
keys shared by the postage evidencing device (PED) 30 
and postal or courier service and by the postage evi- 
dencing device and device manufacturer or vendor. This 
sharing requires coordination of key updates, key pro- 
tection and other measures commonly referred to as a 
key management system. The computation of digital 35 
tokens takes place upon request to generate tokens by 
a mailer. This computation is performed by the postage 
evidencing device. Thus, the postage evidencing device 
needs to have all the information required for computa- 
tion, and, most significantly encryption keys. Moreover, 40 
refilling the postage evidencing device with additional 
postage funds also requires separate keys and a man- 
agement process. In these systems, the process of 
token generation is accomplished with real time token 
computation and tokens can be computed for any com- 45 
bination of input parameters allowed by the system. 
[0008] Various enhanced systems have been devel- 
oped including systems disclosed in US Patent No. 
5,454,038 for ELECTRONIC DATA INTERCHANGE 
POSTAGE EVIDENCING SYSTEM, issued September so 
26, 1995; US Patent No. 5,448,641 for POSTAL RAT- 
ING SYSTEM WITH VERIFIABLE INTEGRITY, issued 
September 5, 1995; and, U.S. Patent No. 5,625,694, for 
METHOD OF INHIBITING TOKEN GENERATION IN 
AN OPEN METERING SYSTEM, issued April 29, 1 997, 55 
the entire disclosure of which is hereby incorporated by 
reference. 

[0009] As noted above, it has been recognized that 



58A2 4 

addressee information can be incorporated into the dig- 
ital token. This provides enhanced security. The inclu- 
sion of addressee information in the digital token 
insures that for an individual to perpetrate a copying 
attack by copying a valid indicia from one mail piece on 
another mail piece and entering it into the mail stream, 
the fraudulent mail piece must be addressed to the 
same addressee as the original valid mail piece. If this 
has not been done, the fraudulent mail piece would be 
detectable as having an invalid indicia upon verification 
at a mail processing facility. 

[0010] It has also been recognized that a level of 
enhanced security can be obtained by generating the 
digital tokens using a subset of addressee information. 
This concept is disclosed in published European Patent 
Application Publication No. 0782108 for A METHOD 
FOR AUTHENTICATING POSTAGE EVIDENCING 
USING DIGITAL TOKENS GENERATED FROM A 
SUBSET OF ADDRESSEE INFORMATION, filed 
December 19, 1996 and published July 2, 1997. The 
published European application discloses, inter alia, 
using the hash code of a predetermined appropriate 
section of each address field as part of the digital token 
transformation process. It is suggested that the first 15 
characters of each line can be selected as such appro- 
priate section of each address field for authentication. 
An error correction code is generated for the selected 
address data using, for example, Reed Solomon or 
BCH algorithms. A secure hash of this section of the 
address field data is generated, which is sent to a vault 
(PED) along with the postage required and date data. 
This information, the section of the address field, is part 
of a request for a digital token. The vault which may be 
coupled to a personal computer (PC) generates the dig- 
ital token using this data. The error correcting code is 
printed on the mail piece in alpha numeric characters or 
bar code format. Upon verification, an OCR system 
reads the delivery address from the mail piece and the 
data from the indicium. Using an OCR or bar code 
reader, the error correcting code is also read. An error 
correcting algorithm is executed using the error correct- 
ing code. If errors are not correctable, then the recogni- 
tion process is notified of a failure. If correctable, the 
appropriate section of each address field is selected for 
authentication. A secure hash of the selected data is 
generated during the verification process. A secure 
hash and the postal data are then sent to the verifier 
which then generates digital tokens that are compared 
to the digital tokens printed on the mail piece to com- 
plete the verification process. 
[001 1 ] It has been discovered that enhanced security 
can be provided in various postal systems employing 
digital tokens as evidence of postage payment by incor- 
porating information into the digital token which is easy 
to recreate from the face of the mail piece. 
[0012] It has been further discovered that many mail 
pieces have addresses that are difficult and sometimes 
impossible to fully read, such that the digital token 
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imprinted on the mail piece cannot be verified. 
[001 3] It is an object of the present invention to pro- 
vide a secure postage token generation and verification 
system which alleviates this difficulty by providing 
redundant information which can be more easily recre- 
ated. 

[001 4] It has been further discovered that the process 
of addressing, postage evidencing, mail sorting and 
automated payment verification can be greatly facili- 
tated by computing certain auxiliary information from 
the destination address data. 
[0015] It has also been discovered that the objective 
of linking the indicium with the mail piece can be sub- 
stantially satisfied, worldwide, for all categories of mail, 
domestic and international, without employing the 
United State Postal Service eleven digit destination 
point delivery code (DPDC) or its equivalents as 
addressee information incorporated in the digital token. 
It has also been discovered that the new method does 
not necessarily require access to the regularly updated 
address databases and works for all mail items, even 
undeliverable as addressed, in this case enabling deter- 
mination of undeliverability. 

[001 6] It is another object of the present invention to 
provide a practical universal system for linking a mail 
piece to a digital token. 

[001 7] It has also been discovered that by printing cer- 
tain information such as the auxiliary information, in an 
appropriate location, as for example the vicinity of the 
destination address block or indicium or both, informa- 
tion capture and processing can be enhanced. 
[0018] It has been additionally discovered that the 
above information may be printed in any other location 
on a mail piece such as in a predetermined easy to 
locate position, e.g. the upper right hand corner of the 
mail piece. This information can be a landmark indica- 
tive of the mail piece address block, by providing coordi- 
nates of the address block using an appropriate 
coordinate system with origin that can be automatically 
and easily located without errors. 
[001 9] It has also been discovered that using an error 
correction code of addressee information which is incor- 
porated into the digital token as part of the digital token 
transformation process, provides enhanced functional- 
ity for mail processing and enables automatic verifica- 
tion of a greater percentage of the mail pieces. 
[0020] It is an object of the present invention to utilize 
an error correction code as information representing 
addressee information in a digital token such that the 
error correction code is redundant with the address 
information. Accordingly, where the error correction 
code can be read from the mail piece, the digital token 
may still be verifiable even if the addressee information 
is not or is only partially readable, since the error correc- 
tion code may be able to be recreated from the redun- 
dant information in the addressee information itself 
when readable. A new error correction code may also 
be generated from the addressee information where the 



error correction code is not readable and the new error 
correction code (which should be identical to the origi- 
nally imprinted error correction code) is utilized to vali- 
date the digital token. Thus, this system is such that 

5 where the address is mutilated to a point that it is unable 
to be reconstructed with the error correction code since 
there are so many errors in the addressee information, 
nonetheless, the digital token can be verified because 
of the error correction code. Where the error correction 

to code is unable to be read, the mail piece digital token 
can still be verified if the error correction code can be 
recreated from the address information where it is not 
obliterated or mutilated beyond use to generate an 
accurate error correction code. 

w [0021 ] This provides the ability to process larger por- 
tions of mail verifying the digital token and thereby 
detecting practical attempts to defraud the mail 
processing system as, for example, by intentionally 
mutilating a portion of the addressee information while 

20 leaving sufficient addressee information such that the 
mail piece is still deliverable. Also, where the error cor- 
rection code is not readable, the addressee information 
can be used. 

[0022] Moreover, it must be recognized that by utiliz- 
es ing the error correction code as input to the digital token, 
the attempts to thwart the system by obliterating a por- 
tion of the addressee information but leaving enough 
information so that it is deliverable is protected to a 
greater extent. This is because where full addressee 
30 information is used as part of the digital token verifica- 
tion system, the full address must be recognized and 
used in processing the verification of the digital token. 
This also inhibits the ability of unscrupulous mailers to 
more easily make duplicates to attack the mail stream 
35 by copying, for example, an eleven digit delivery point 
destination code as is used in the United States, and 
having an address which is inconsistent with this deliv- 
ery point destination code. In such case, the digital 
token would verify and, through manual processing, the 
40 mail piece may still be appropriately delivered. 

[0023] It has also been discovered that address block 
structure information may be included, in easily 
machine readable form, on each mail piece to facilitate 
and enhance automated reading of the address block 
45 for sorting, delivery and/or verification purposes. The 
address structure information can serve as input to the 
digital token transformation (DTT) and/or used to facili- 
tate enhance machine reading. 
[0024] A method for generating postage evidencing 
so information embodying the present invention includes 
generating an error correction code for information on a 
document and generating a digital token employing the 
error correction code. The information may be a portion 
of the destination address on a mail piece. 
55 [0025] In accordance with an aspect of the present 
invention a method for evidencing information printed 
on a document includes obtaining an error correction 
code printed on a document and employing the 
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obtained error correction code to verify the validity of 
evidencing information. The evidencing information may 
be postage evidencing information printed on a mail 
piece. 

[0026] In accordance with a feature of the present 
invention, a method for verifying postage evidencing 
information printed on a mail piece includes obtaining 
an error correction code printed on a mail piece and 
determining that the obtained error correction code is 
inaccurate. The information employed to generate the 
error correction code is obtained and an error correction 
code is generated from the obtained information. The 
generated error correction code is employed to verify 
the validity of the postage evidencing information. 
[0027] In accordance with still another aspect of the 
present invention a method for verifying postage evi- 
dencing information printed on a mail piece includes 
generating an error correction code from at least a por- 
tion of addressee information printed on said mail piece 
and employing the generated error correction code to 
verify the validity of said postage evidencing informa- 
tion. 

[0028] In still another further feature of the present 
invention a method for generating a mail piece includes 
generating an error correction code for a destination 
address and generating address structure information 
for the destination address. The error correction code 
and address structure information is imprinted on said 
mail piece. 

[0029] In yet still another aspect of the present inven- 
tion a method for generating evidencing information 
includes generating an error correction code for infor- 
mation and generating structure information for the 
information. The error correction code and address 
information is imprinted on a mail piece and a digital 
token is generated employing the error correction code 
and/or the structure information. The information may 
be postage evidencing information and the error correc- 
tion code and the structure information can be that of at 
least a portion of mail piece destination information. 
[0030] A complete understanding of the present 
invention may be obtained from the following detailed 
description of the preferred embodiment thereof, when 
taken in conjunction with the accompanying drawings, 
wherein like reference numerals designate similar ele- 
ments in the various figures, and in which: 

FIGURE 1 is a block diagram of a system for print- 
ing mail pieces and verifying mail pieces which 
embodies the present invention; 
FIGURE 2 is a mail piece printed by the system 
shown in FIGURE 1 and includes formatting infor- 
mation and an error correcting code printed on the 
mail piece in alpha numeric form and with the error 
correction code included in the calculation of the 
digital token printed as part of a 2D bar code; 
FIGURE 3 is a mail piece printed by the system 
shown in FIGURE 1 and having the error correction 



code printed in the 2D bar code and an indicia hav- 
ing alpha numeric digital tokens which includes, as 
part of the input to the DTT, the error correction 
code; 

5 FIGURE 4 is a mail piece similar to that shown in 
FIGURE 3, with the 2D bar code relocated adjacent 
the address block to provide enhanced address 
block landmark identification; 
FIGURE 5 is a mail piece similar to that shown in 

w FIGURE 3 incorporating a different form of 2D bar 
code and with the imprinted bar code located in a 
different position relative to the imprinted indicia; 
FIGURE 6 is a flow chart of the mail piece genera- 
tion process employing the present invention; and, 

15 FIGURE 7 is a flow chart of the verification process 
of the mail piece created in accordance with the 
process shown on FIGURE 6. 

General Background 

20 

[0031 ] The main purpose of a digital indicium is to evi- 
dence that postage for a given mail item has been paid, 
various implementations for digital postal indicia have 
been proposed. In selecting an implementation, it is 
25 desirable that the digital postal indicia satisfy the follow- 
ing set of requirements: 

1) Information printed in the indicium shall be linked 
with payment. 
so 2) Each digital indicium shall be unique. 

3) Each digital indicium shall be linked with the mail 
item for which it provides evidence of payment. 

4) Indicium verification process shall be simple and 
effective, e.g., it should be completely automated 

35 except for mail pieces requiring special handling or 
attention or (if desired) a simple manual process 
that can be performed by mail carriers who handle 
mail for delivery. 

40 [0032] The first requirement is usually satisfied using 
cryptographic techniques. In its simplest form the link 
between the payment and the indicium is achieved by 
printing encrypted information that authenticates the 
information imprinted on the mail piece (digital tokens) 

45 in the indicium that can be computed only by the device 
in the possession of secret information (a key). This key 
serves as an input to an algorithm producing, for exam- 
ple, a message authentication code (MAC) or a digital 
signature. Each access to the key results in accounting 

so action such as subtraction of the postage from a post- 
age register holding postal money. 
[0033] The second requirement provides a detection 
mechanism for unauthorized duplication of indicia. 
Printing a unique identification on each mail piece satis- 

55 ties this requirement. 

[0034] The third requirement is desirable in order to 
simplify the detection of reused or duplicate indicia. In 
particular, it is very desirable to achieve the verification 
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of the indicium without access to external sources of 
information, such as databases of already used and 
verified indicia. This requirement considerably simplifies 
means for satisfying the last requirement. Postage 
meters meet this requirement either by use of unique 
printers and inks, or by linking information on the mail 
piece to the indicium. 

[0035] The system described herein addresses, inter 
alia, the requirement of the linkage between the mail 
piece and the indicium. This linkage has been provided 
by including data, unique to a mail piece, as an input to 
cryptographic transformation computing the encrypted 
information (digital tokens). Of the data present on the 
mail items, there is one primary candidate of such 
unique data, namely the destination address. By incor- 
porating the destination address into a digital token 
along with other relevant information e.g. date, postage 
amount, device identification, the postage evidencing 
device effectively eliminates possibility of reusing once 
issued (and paid) indicium information for unpaid mail 
pieces, with the exception of mail pieces destined to 
exactly the same address on the same day. This last 
attack subjects the attacker to high risk (since mail 
pieces are to the same addressee on the same day), 
with little economic benefit to the attacker. Thus, it is 
desirable to include the destination address into digital 
tokens. 

[0036] The above approach, however, has to over- 
come multiple difficulties. Address information and its 
presentation format must be standardized in such a way 
that the verification process should be able to produce 
(based on the address present on the mail piece) the 
address input data exactly identical to the address input 
data used during the indicium generation process by the 
postage evidencing device. This standardization must 
also accommodate international mail. This means that: 
a) mail with the destination outside of a given country 
must be processable as well as domestic mail; and, b) 
mail within countries which do not use any postal codes 
or use only relatively short (and therefore not unique to 
the address) postal codes, that for example easily indi- 
cate a post office, must be processable as well. The pre- 
vious requirements persist even when the address 
information printed within indicium in a machine-reada- 
ble format such as two-dimensional bar code. 
[0037] The root of the problem lies in the fact that a 
postage evidencing device for many applications com- 
putes the indicium information including digital tokens 
from a computerized file of input data or other compu- 
terized input data such as keyboard entry, while a verifi- 
cation process must compute digital tokens from the 
data scanned (or otherwise obtained, for example, by 
manual keying) from the mail piece where this data 
exists in the form of optical images. The process of 
interpreting optical images in order to obtain a compu- 
terized file is notoriously error prone and the probability 
of error grows fast with the growth of the information 
content of the optical image. On the other hand crypto- 
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graphic verification fails, even in the presence of a sin- 
gle error in the interpretation of the optical image. The 
cryptographic verification process is not error tolerant. 
[0038] In the United States of America, the United 

5 States Postal Service defined an 1 1 digit destination 
point delivery code (DPDC) uniquely indicative of the 
destination address. This code, when present on the 
mail piece and known to the postage evidence produc- 
ing device, can serve as the required input to the digital 

w token calculation. However, even in the United States of 
America this DPDC code is not defined for many 
addresses. Access to this code requires possession of 
huge databases that must be distributed to a large 
number of end users and updated on a frequent basis. 

15 This poses a very significant financial burden for mailers 
and posts. Moreover, a code similar to DPDC does not 
exists in a vast majority of other countries including 
major countries of the industrial world, thus reducing 
utility of the DPDC approach considerably. Additionally, 

20 many postal administrations resist introduction of long 
DPDC viewing them as unnecessary for the main func- 
tion of the postal service, mainly mail sorting and deliv- 
ery. 

[0039] A significant problem also encountered in mail 
25 processing is the problem of automatic mail sortation. 
Solution of this problem usually requires several sepa- 
rate processing steps, namely: 

1) Finding the destination address block in the dig- 
so ital image of the face of the envelope. 

2) Parsing the address block into lines and words, 

3) Segmenting of address words into individual 
characters, 

4) Recognizing individual characters by Optical 
35 Character Recognition (OCR) process, 

5) Interpreting of address information to execute 
sorting. 

[0040] Each of the above-identified processing steps 

40 may fail thus frequently introducing irrecoverable errors. 
Finding the address block, parsing and segmenting may 
be responsible for up to 60% of failures in processing of 
machine printed mail, leaving only 40 % of errors to the 
OCR and interpretation. Therefore, it is desirable to 

45 assist mail-processing equipment in performing at least 
the first four processing steps described above. 
[0041 ] It is well known, and is being already practiced 
in several countries, to use address block locators. 
These address block locators are a specially printed 

so graphic or alphanumeric symbols on the envelope 
which are relatively easy to locate in the digital image 
and which are indicative of the location of the destina- 
tion address in the envelope. In some countries, pre- 
printed vertical lines or special symbols such as 

55 asterisks are used. Some other countries are contem- 
plating use of a series of numeric characters printed 
above or below the address block with the length of this 
series equal to the length of the longest line in the 
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address block. Yet some other countries may use a lin- 
ear barcode also printed above or below the address 
block with a similar length restrictions as in the case of 
numeric characters. These arrangements however do 
not address any of the processing steps 2, 3 and 4. 
[0042] For many mail pieces, computation and format- 
ting of the data needed to create a mail piece including 
the destination address block and the indicia is done by 
a computer (e.g. a standard off-the-shelf Personal Com- 
puter). The processes of addressing, postage evidenc- 
ing, mail sorting, and automated payment verification is 
greatly facilitated by the present system in computing 
certain auxiliary information from the destination 
address data and printing this information in an appro- 
priate location and orientation in the vicinity of the desti- 
nation address block or indicium or both. Alternatively, 
this information may be printed in any other location on 
the mail piece but should be indicative of the address 
block coordinates within an appropriate coordinate sys- 
tem with an origin that can be automatically located 
easily and without errors. Thus, mail preparation and 
processing, mail sorting and payment verification, is 
enhanced by printing certain additional information on 
the mail piece. Integration of mail processing and pay- 
ment verification is also advantageous and very cost 
effective when both processes can benefit from such 
integration, for example, during an automated mail sort- 
ing process. 

[0043] As previously noted, the process of producing 
digital tokens, digital signature or ciphertext by postage 
evidencing devices is well known. The input to the dig- 
ital token transformation may be formed by the date of 
mailing, postage value, non-resettable serial piece 
count or the value of the ascending register (understood 
in a traditional sense of the postage meter architecture), 
the postal code of the post office which registered the 
device, and some other optional information if desired. 
The digital token transformation generates a pseudo- 
random number or digital token from these data by 
applying a secret key. In one known implementation the 
algorithm employed is double or triple DES in a Cipher- 
Block-Chaining Mode. The resulting MAC is truncated 
to a single digit, which represents a single digital token. 
Two digits can be used to represent two digital tokens, 
etc. If desired, digital tokens can be longer than a single 
digit, up to the full MAC. Each digit appears to be a ran- 
dom number to a party without knowledge of the secret 
key. The idea of employing two separate secret keys 
(one controlled by the vendor of postage evidencing 
device and another controlled by the accepting Post) is 
also well known. 

The System 

[0044] A mailing envelope may contain traditional ele- 
ments, such as indicia and destination address block. 
As an example, the indicia may consist of two blocks of 
data, the human readable block with conventional ele- 
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ments such as postage and date and bar coded block. 
This bar-coded block contains digital tokens and other 
data elements that can assist in automated mail sorting 
such as data elements which can help in facilitating mail 

5 reading processes mentioned above. It should be 
expressly noted that the present system could be imple- 
mented in various forms. For example if a public key 
cryptographic scheme is used, then the indicium can 
contain a digital signature (with or without public key 

w certificate signed by a Certification Authority) as well as 
just a ciphertext. The ciphertext for all known secure 
public key systems is fairly large and independent of the 
size of the plain text up to the upper limit determined by 
the size of the key used. This means that in many appli- 

ib cations of secure indicia there is room in the plain text 
that would normally be padded by non-functional infor- 
mation. Thus, this room can be used to include in the 
plain text (and subsequently retrieve from the cipher- 
text) certain information useful for address processing, 

20 such as, for example, coordinates of the address block, 
composition of the address block in terms of the number 
of lines, number of words and number of characters in 
each line, the identity of the print font used for printing 
the address etc. Such information together with an 

25 appropriate Error Correction Code (ECC) can greatly 
improve computer processing of the address, essen- 
tially eliminating all irrecoverable errors at least in the 
PC metering environment and, more generally, when 
mail pieces to be processed have been imprinted by 

30 computer driven systems. 

[0045] One of the purposes of the method of the 
present system is to provide an effective deterrence and 
detection mechanisms for duplicated digital indicia. 
From this point of view, if an unscrupulous mailer pur- 

35 posely changes the address by corrupting the address 
information, for example, by introducing several extra 
characters or changing several characters or words in 
order to create corrupted but deliverable addresses, 
such that this address will have an Error Correction 

40 Code and an address structure information identical to 
the Error Correction Code and address structure infor- 
mation of another legitimate address, such event is eas- 
ily detectable by mail carriers (and other postal 
personnel with the access to mail) by a simple direct vis- 

45 ual examination. Thus, mail pieces with addresses 
altered in such manner will arouse suspicion being unu- 
sually addressed, and so pointing to such unscrupulous 
mailer. This will warrant investigation, which can easily 
detect the fraud upon interception of several different 

so pieces with identical indicia. If a certified copy of the 
address data base and address cleansing software is 
supplied to a mailer, then the cleansing software will 
automatically eliminate all artificially created errors and 
misspellings at least for all addresses common to the 

55 mailer's mailing list and the data base. (This covers a 
vast majority of the mailing lists used by business and 
recreational mailers even without regular updating of 
address database). If mailer still proceeds with artificial 
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alteration of the delivery addresses in order to avoid 
payment by duplication of legitimate indicia, then this, 
again, can be detected by simple direct visual examina- 
tion. In this case the postal law enforcement authority 
will have a proof of deliberate alteration by the mailer for 5 
the purpose of fraud since no computer system in pos- 
session of an adequate address data base will generate 
mail with such corrupted addresses. This could, for 
example, be a certified address data base. 
[0046] The system may be implemented with a PC or w 
equivalent (e.g. single board computer), a vault (also 
known as PED) operatively connected to the PC and a 
printer driven by a PC. The mailer may enter into the PC 
(e.g. via some external storage media, such as mag- 
netic diskette, CD ROM, network or a key board) mailing is 
list of addresses of recipients (where the mailer wants to 
mail his or her messages) together with an associated 
list of rating parameters or postage rates for each mail- 
ing address. Typically, the rating parameters consists of 
weight and an indicator of the size of the mail piece 20 
(regular or oversize). The rating parameters together 
with the rating table (or tariff table) stored in the PC 
should enable the PC to compute postage value for 
each of the addresses in the mailing list. After perform- 
ing postage computation, the PC computes an Error zs 
Correction Code (ECC) for each address. This ECC can 
be of many different types, linear or nonlinear depend- 
ing on the computational requirements and capabilities 
of the coding and decoding systems. In the mailing envi- 
ronment, these computational constraints are usually 30 
not as strong as in high-speed high bandwidth commu- 
nications networks. 

[0047] One commonly used type of ECC is the Reed- 
Solomon Code (R. Blahut, Theory and practice of Error 
Control Codes, Addison-Wesley Pub. Co, 1984). The 
Reed-Solomon Code is constructed over the finite field 
GF(q), where q is the number of elements in the field. N 
is the length of the code, that is, the code word uses N 
field elements and it is a factor of the number of non 
zero elements in the field. If the dimension of the code 
is k (i.e. there are q k code words) then (N, k) Reed-Solo- 
mon code (RS code) over GF(q) can detect N-k errors 
or correct [(N-k)/2] errors, where square bracket denote 
the largest integer smaller than or equal to (N-k)/2. In 
the case of error correction two types of errors are typi- 
cally considered: erasures (known in the OCR field as 
rejections) and errors of misrepresentation (known in 
the OCR field as substitutions). The distance for the RS 
code is d = N-k+1 . The RS code with such distance can 
correct "s" substitutions and "r" rejections if d >2s + r. 
The delivery address information including the struc- 
tural information defined as the number of lines in the 
address, the number of words and characters including 
spaces in each line, the code for the type(s) of printing 
font and possibly other similar characteristics can be 
represented as a binary array or a message over the 
alphabet {0,1}. A second possible alphabet is used to 
represent the message for example as a 128 symbols 



(each symbol being an ASCII code of 1 byte). Out of 
128 symbols, 112 symbols represent address and its 
structural information and 16 symbols represent parity 
(correction) symbols. 

[0048] Yet another example uses the properties of the 
alphanumeric alphabet with upper case letters, numer- 
als, a space, a new line, and a punctuation symbol. A 
RS code using GF(1601) encodes two of these charac- 
ters per field element. Selecting field element 13 as a 
generator, we find that 13 has order 64, i.e. 13 64 = 1 
mod 1601. The address read-assistance code consists 
of error correction information and address structure 
information. To correct 5 substitutions or 10 rejections 
requires 11 field elements. The address structure infor- 
mation, which consists of, for example, number of char- 
acters in each of a maximum of five lines uses 3 field 
elements. The address read-assistance code thus uti- 
lizes 11+3 = Hfield elements. 63 field elements repre- 
sent a single codeword in this Reed Solomon code. The 
remaining 63-14=49 field elements are used to repre- 
sent delivery address information, which in this case is 
limited to a maximum of 98 characters. The address- 
read-assistance code can be represented in the form of 
a two-dimensional bar code such as DataMatrix code. 
In this case, the amount of space in the address block 
required to do so is 0.34 inches square with the module 
size equal to 0.020 inch. This is quite feasible. The error 
correcting capability of the code just described will be 
able to correct performance of even very modestly 
accurate OCR algorithm (90% accurate recognition 
rate). 

[0049] The verification process applicable to the 
present method involves first scanning the mail piece 
and obtaining a digital image of the indicia and the 
address block. The second phase of the verification is 
as mentioned above a direct examination of printed 
delivery address by mail handling and delivery person- 
nel in order to detect any artificially created errors. This 
second phase can also be automated when address 
reading software is updated to detect and flag any unu- 
sual errors and misspellings. Both the manual and auto- 
mated methods can be used if needed since they take 
place during different stages of mail processing cycle. 



[0050] Reference is now made to FIGURE 1 . A com- 
puting system which may be, for example, a personal 
computer 104 includes optionally an address data base 
106. It should be recognized that the system can either 
be a stand alone PC system or a network system or 
other suitable computing arrangement. A printer 108 
prints a series of mail pieces shown generally at 110. 
The mail pieces may include a 2D bar code encrypted 
indicia shown at 112 and have imprinted format error 
correction code information for addressee information 
on the mail piece shown at 1 14. 
[0051] The encrypted indicia includes information 
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authenticating the payment of postage for the mail 
piece. A relationship may exist between the addressee 
information error correction bar code and the encrypted 
information so as to provide an enhanced robust digital 
token generating and verification system. As noted 
above, the system accommodates digital token verifica- 
tion where addressing information cannot be recreated 
in automated mail processing and in situations where 
the addressee information error correction code cannot 
be accurately obtained. The system also provides a 
enhanced ability to recover addressee information in a 
way that facilitates mail processing. 
[0052] The mail pieces 1 1 0 are submitted to a receiv- 
ing facility shown generally at 1 1 6. The mail stream may 
be processed by a sorter 118 which reads addresses 
associated with the mail piece with the assistance of the 
error correction code. A sampling of the mail stream 
may be fed to a verification processing system shown 
generally at 120 as sampled mail piece 122 is scanned 
by a scanner 124, which is connected to a verifier proc- 
essor 126. For secret key systems, that is, systems 
where the digital token is encrypted using a secret key, 
a crypto co-processor 128 may be coupled to the veri- 
fier processor 126. A crypto key data base 130 is cou- 
pled to the verifier processor 126. 
[0053] It should be recognized that the particular print- 
ing system and the particular verifying system is a mat- 
ter of systems design choice. For example, rather than 
employing a secret key system for generating the digital 
tokens a public key system may be employed for gener- 
ating the digital token. Alternatively, various forms of 
encryption may be employed in the system as, for 
example, elliptic curve digital signature, data encryption 
standard and RSA. Furthermore, the form and format of 
the printed information can be substantially modified 
and beneficially employ the aspects of the present 
invention. The key data base 130 may not be required 
where the digital indicia includes a digital certificate as 
set forth in the USPS Information based Indicia pro- 
posed Specifications and in U.S. Patent No. 4,853,961 
issued August 1, 1989 for RELIABLE DOCUMENT 
AUTHENTICATION SYSTEM. 
[0054] Reference is now made to FIGURE 2. A mail 
piece 202 includes a indicia shown at 204 and a 2D bar 
code shown at 206. Sender address information is 
shown at 208 and recipient addressee information at 
210. An error correction code for recreating the 
addressee information 210 is generated and printed on 
the mail piece at 212. A bar-half bar, for example, code 
may also be imprinted on the mail piece at 214. The 
indicia shown at 204 may include graphic information 
216, postage amount information 218, meter or secure 
token generator serial no. 220, origin postal code 222 
and the date of the imprint 224. Some or all of this infor- 
mation may be encrypted into the 2D bar code 206 as 
part of the digital token along with all or part of the error 
correction code 21 2. This digital token incorporating this 
information may be retrieved through scanning at a later 



time, to verify the authenticity of the indicia 204. The 
bar-half bar code 2 1 4 may be a Post Net bar code which 
may include any desired information to assist existing 
scanning equipment at postal services in the writing 

5 process. This information may be the complete 1 1 digit 
destination point delivery code (5 digit Zip plus 4 digit 
plus 2 digit code) as employed in the United State 
Postal Service or portions of the addressee information, 
such as the destination code of the receiving post office. 

to It should be noted that the mail piece has printed on it 
two different forms of bar code as well as other informa- 
tion to make the system more robust. 
[0055] Certain address block structure information 
226 may also be included on the mail piece. This 

is address block structure information may include the 
coordinates of the address block, composition of the 
address block in terms of the number of lines, number of 
words and number of characters in each line, the iden- 
tity of the print font used for printing the address, etc. 

20 Such information shown diagrammatically at 226, 
together with an appropriate error correction code 212 
can greatly improve computer processing of the 
address, and may, greatly reduce or essentially elimi- 
nate all irrecoverable errors, particularly in computer 

25 controlled mail printing environment. 

[0056] It should be expressly noted that not only can 
the error correction code 212 be included in the digital 
token transformation process but, additionally, this addi- 
tional information 226 can also be beneficially included 

30 as part of the digital token. 

[0057] It should be explicitly recognized that the for- 
matting information 226 is very important in augmenting 
the information provided by the error correction code to 
enable the recovery of the correct addressee informa- 

35 tion 210. This is particularly true because certain cor- 
rupted information as read from a mail piece may 
preclude the error correction code from enabling the 
recreation of the addressee information. One such 
example would be where the scanning process miscon- 

40 strues two adjacent characters or numbers as being a 
single letter such as the sequence of letters "IV" being 
interpreted as an "N." In such case, the error correction 
code would not, in and of itself, necessarily be sufficient 
to recreate the correct addressee information. However, 

45 along with the formatting information, such recovery 
may be facilitated. 

[0058] It should be recognized that while the United 
States Postal Service Information Based Indicium Pro- 
gram draft specification employs the delivery point des- 

50 tination code for use in the digital token transformation 
process, the present system is more universal and more 
secure in that it does not rely on a particular addressing 
scheme as, for example, one employing zip code infor- 
mation and further is specific to the specific addressee 

55 or recipient of the mail piece. This further enhances the 
protection against a duplicate attack on the system 
where duplicate mail pieces are entered into the mail 
stream. 
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[0059] One implementation for address structure infor- 
mation 226 is shown in the first seven digits "4343411" 
above the address. The first digit "4" represents the dis- 
tance in inches from the right edge of the envelope to 
the left edge of the address. The second digit "3" repre- 
sents the distance in inches from the top of the enve- 
lope to bottom of the address block. The third digit "4" is 
the number of lines in the address field. The remaining 
four digits "341 1" are each calculated from the number 
of characters and number of words in a line. The first of 
these four digits "3" corresponds to the first line of the 
address. The code for a line is given by ((number of 
characters) mod 3) + 3 • ((number of words) mod 3), 
where mod 3 is the remainder after dividing by 3. The 
two values, ((number of characters) mod 3) and 
3 • ((number of words) mod 3) can be easily calculated 
from the code. 

[0060] The first line "Ms. CD. Receiver" contains 4 
words and 1 2 characters. The code is therefore "3". The 
other lines follow similarly. "P.O. Box 12345" has four 
words and ten characters. The structure code for this 
line is therefore "4". The street address, "456 Washing- 
ton Street" has three words and nineteen characters, as 
does the city-state line. The last two lines therefore cor- 
respond to "1". 

[0061 ] In this example, a character is either a letter or 
a numeral; punctuation and spaces are not included as 
characters. Any string separated by a space or punctu- 
ation is treated as a separate word. Therefore, "CD." 
counts as two characters and two words. Many other 
implementations are possible, including counting punc- 
tuation as characters, only counting word boundaries 
with spaces or including more detailed information 
about each word. 

[0062] Reference is now made to FIGURE 3. A mail 
piece 302 contains a sender address information at 304 
and recipient addressee information at 306. It should be 
noted that the addresses involved are addresses in the 
United Kingdom and France as opposed to the 
addresses in FIGURE 1 involving addresses in the 
United States. This is because the present invention is 
suitable for use with all forms of addressing schemes 
employed by the world wide postal services. An indicia 
308 includes various relevant information. A date of 
mailing is imprinted at 310 as well as the postal amount 
at 312. The amount shown is one Euro. Additionally, the 
metering or secure encrypting device serial number is 
imprinted at 314 as is the originating postal code of the 
mail piece at 316. Digital token information is imprinted 
on the mail piece at 318. The digital tokens may be sin- 
gle digit tokens such as the 5 and the 6, one associated 
with the vendor and one associated with the postal serv- 
ices as set forth in the above noted prior patents. The 
numeral 1 may be a designation of the manufacturer 
and the numeral 0 is an error detection code associated 
with the metering device number. An error detection 
code for the entire indicia may be provided at 310 and a 
serial piece count associated with the metering device 
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at 322. 

[0063] A 2D bar code 324 is imprinted adjacent to the 
digital indicia. The 2D bar code 324 may include the dig- 
ital tokens 5 and 6 printed in alpha numeric form as part 

5 of the digital indicia and further include an error correc- 
tion code associated with the addressee information 
306 and similar to the information contained in the 
numeric code 212. Additionally, the 2D bar code 324 
may include the formatting information associated with 

10 the addressee information 306 similar to the formatting 
information imprinted in numeric form at 226 as shown 
in Figure 2. 

[0064] Reference is now made to FIGURE 4. FIGURE 
4 includes similar information to that shown in FIGURE 
is 3. Corresponding type numbers show corresponding 
elements in FIGURE 4. The 2D bar code 424, however, 
is imprinted adjacent to the addressee information 406. 
By imprinting the 2D bar code 424, as shown in FIG- 
URE 4, a major landmark is provided for the scanning 
20 equipment to locate the area which contains the 
addressee information. This is particularly important 
since mail pieces come in various sizes and forms and 
addressee information is imprinted in many different 
locations on such mail pieces and in many different for- 
25 mats and styles. Moreover, since much other extrane- 
ous information may be imprinted on a mail piece such 
as "express mail", "open immediately," "air mail", etc., 
the provision of a major landmark such as the 2D bar 
code 424 provides great assistance. Since the land- 
so mark 424 is also the 2D bar code providing the neces- 
sary information, including the formatting information 
and the error correction code, valuable real estate on 
the mail piece is saved, as opposed to having the 2D 
bar code in a different location with a different form of 
35 addressee landmark identification imprinted on the mail 
piece. 

[0065] Reference is now made to FIGURE 5. A mail 
piece 502 includes sender address information 504 and 
addressee information 506. The particular indicia 

40 shown on the mail piece in FIGURE 5 is divided 
between human readable portion and a 2D bar code 
portion. The human a readable portion 508 includes the 
date the mail was imprinted at 51 0, the postal amount at 
512, the serial number of the metering device at 514 

45 and the sender postal code at 516. A 2D bar code at 
524 includes the digital token as well as the error cor- 
rection code information shown at 212 in FIGURE 2 and 
the address structure information shown at 226 in FIG- 
URE 2. All this information along with the various 

so encrypted information authenticating the mail piece as 
having postage paid is imprinted in the 2D bar code 
524. 

[0066] The 2D bar codes shown in FIGURES 2, 3 and 
4 are DataMatrix type 2D bar codes. The 2D bar code 
ss shown in FIGURE 5 is a PDF417 type bar code. The 
indicia imprinted on mail piece 5 may be a public key 
encryption scheme based digital indicia which is 
imprinted in the PDF41 7 format as shown at 524. 
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[0067] As is apparent from the above four different for- 
mats of mail pieces shown in FIGURES 2-5, various 
forms and organizations of the present invention 
employing error correction code and/or format informa- 
tion as part of the encryption of addressee information s 
into the digital tokens may be employed. Moreover, 
these digital tokens may be of the secret key type or the 
public key type, depending upon the particular system 
implemented. 

[0068] Reference is now made to FIGURE 6. The io 
delivery address information and corresponding mail 
piece rating parameters or rate are entered into the 
processing system 104 of FIGURE 1 at 602. Address 
structure information and error correction code for the 
address is computed at 604. The digital token is then is 
computed at 606. The digital token maybe of a type 
encrypting the calendar date, postage rate data, meter- 
ing device serial number, ascending register, and origi- 
nating postal code. The specific information and the 
type of digital token transformation as well as the partic- 20 
ular encryption algorithm employed may vary depend- 
ing upon the system design choice. The digital token 
also employs the error correction code and/or the 
address structure information as input computed at the 
step 604. The delivery address with error correction 25 
code and address structure information is printed on the 
mail piece at 608. It should be noted that if the format 
employed is as shown in FIGURE 2, the information at 
608 is printed as part of the address block. However, the 
information maybe printed in different forms and in dif- 30 
ferent locations as shown in FIGURES 3-5. The digital 
indicia, including the digital token, is printed at 610. 
Optionally, an ad slogan may also imprinted at this time. 
[0069] Reference is now made to FIGURE 7 showing 
the operation at the verification facility. The face of the 35 
mail piece is scanned and the image is obtained and 
digitized at 702. The encoded address structure infor- 
mation and error correction code is determined from the 
digitized image at 704. The address structure informa- 
tion and error correction code is decoded and inter- 40 
preted at 706. The address block is located and parsed 
at 708 in preparation for further processing. The further 
processing includes optical character recognition which 
is performed at 710. A determination is made at 712 
whether the address structure and error correction code 45 
is decodable. 

[0070] If the address structure and error correction 
code is not decodable, the address structure and error 
correction code is reconstructed from the OCR output at 
714. This step provides the added utility of insuring a so 
higher number of mail pieces will be verifiable not with- 
standing inability to decode address structure and error 
correction code information. As noted above, the error 
correction code and/or address structure information 
are included in the encryption digital token transforma- 55 
tion to generate the digital token imprinted on the mail 
piece. Without this information, the mail piece indicia 
cannot be verified to determine its authenticity and pay- 



ment of postage. Accordingly, the ability as part of the 
process to reconstruct the address structure and error 
correction code from the OCR output provides an 
enhancement and improved robustness of the entire 
process not found in prior systems. 
[0071 ] After the address structure and error correction 
code is reconstructed from the OCR output, a determi- 
nation is made that the correct address block has been 
obtained at 716. This block is directly accessed from 
decision block 712 if the address format and error cor- 
rection code was decodable. A further determination is 
made at 71 8 as to whether the mail is deliverable. If the 
mail is not deliverable, that is, incomplete or undeiivera- 
ble address or unrecoverable address, the mail piece is 
rejected at 720. 

[0072] If the mail piece is deliverable, the indicia is 
found and interpreted at 722. Additionally, and option- 
ally, if the error correction code is in the indicia itself in 
unencrypted form as may be the case as explained in 
connection with FIGURES 3-5, the error correction code 
is obtained from the indicia at 724 or from the 2D bar 
code, as the case may be. A determination may be 
made at decision block 726 whether the mail piece data 
is consistent. This can be for example an analysis to 
determine consistency between the address structure 
information and the error correction information 
obtained at 706. The address block information 
obtained at 710, the indicia information obtained at 722 
and, optionally, should it be the case, the error correc- 
tion code information obtained at 724 are all, or some 
portion thereof, are consistent. This check for consist- 
ency can also include the verification of the digital token 
as being an authentic digital token for the sample 
number of mail pieces tested which can be from a very 
small sample to essentially a 100% of the mail pieces, 
depending upon the level of security and verification 
that is needed for the system design. 
[0073] If the mail pieces are determined to be consist- 
ent, the mail pieces are sorted and delivered at 728. If, 
on the other hand, the mail piece data is not consistent, 
an investigation of the mail piece may be initiated at 
730. 

[0074] An alternate embodiment of the system for a 
printed document is a "document read-assistance and 
authentication code." 

[0075] A bar code may contain the "document read- 
assistance and authentication code." This bar code may 
employ an internal error-correcting code, thus assuring 
reliable reading. The code may consist of some or all of 
the following: 

1) Formatting information indicating the number of 
pages and iines per page. 

2) Formatting information that indicates the number 
of words and characters in each line. 

3) Other formatting information, such as overall 
geometric description of the page, fonts used, par- 
agraph format, etc. 
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4) An indication which parts of the document (for 
example, which lines) are included in the error-cor- 
recting code. 

5) An error-correcting code for the indicated parts. 
The level of error-correction can be different for dif- 
ferent parts of the document. 

6) A cryptographic digital signature computed using 
the error-correcting code and formatting informa- 
tion. 

[0076] The error-correcting code can be strong 
enough to make intractable the problem of finding 
another usable document contents with the identical 
code. As an extreme example, the error-correcting code 
can be strong enough to reconstruct the whole docu- 
ment, or the indicated parts. 

[0077] The level of error correction can be different for 
different parts of the document. A simple error-detection 
code can be used for some lines; some selected critical 
lines may, at the signer's discretion, employ a code that 
allows reconstruction of the selected lines. Even the 
error-detection code, combined with the formatting 
information, provides valuable assistance for accurate 
optical character recognition. This information assists 
with parsing a line into words and characters, and pro- 
vides a measure that allows accurate decisions where 
the OCR output is uncertain. 
[0078] The cryptographic signature provides assur- 
ance that the document source is authentic and the doc- 
ument is unchanged. 

[0079] There are several advantages to generating 
the cryptographic signature using the error-correcting 
code and the formatting information. If some part of the 
document cannot be reconstructed completely, the sig- 
nature can still be verified. If "most" of the document 
read-assistance code matches the readable part of the 
document, then the signature provides a signer-selecta- 
ble level of assurance. By verifying a signature associ- 
ated, to varying degrees with the whole document, the 
reader is provided assurance that the document part 
with strong error correction is indeed part of the overall 
document. There is a significant difficulty with verifying 
a digital signature based on a secure hash. Every part 
of the input must be read exactly correctly for the signa- 
ture to verify. While this is quite possible for a document 
in digital form, it is much more difficult for a printed doc- 
ument. 

[0080] While the present invention has been disclosed 
and described with reference to a single embodiment 
thereof, it will be apparent, as noted above that varia- 
tions and modifications may be made therein. It is, thus, 
intended in the following claims to cover each variation 
and modification that falls within the true spirit and 
scope of the present invention. 

Claims 

1. A method for generating postage evidencing infor- 



mation comprising the steps of: 

a) generating an error correction code for at 
least a portion of a destination address; and, 
5 b) generating a digital token employing said 

error correction code. 

2. A method for verifying postage evidencing informa- 
tion printed on a mail piece, comprising the steps 

10 of: 

a) obtaining an error correction code printed on 
a mail piece; and, 

b) employing said obtained error correction 
75 code to verify the validity of said postage evi- 
dencing information. 

3. A method for verifying postage evidencing informa- 
tion printed on a mail piece, comprising the steps 

20 of: 

a) obtaining an error correction code printed on 
a mail piece; 

b) determining that the obtained error correc- 
ts tion code is inaccurate; 

c) obtaining the information employed to gener- 
ate said inaccurate error correction code; 

d) generating an error correction code from 
said obtained information; and, 

30 e) employing said generated error correction 

code to verify the validity of said postage evi- 
dencing information. 

4. A method for verifying postage evidencing informa- 
35 tion printed on a mail piece, comprising the steps 

of: 

a) obtaining an error correction code printed on 
a mail piece for other information printed on a 

40 mail piece; 

b) determining that the obtained error correc- 
tion code is inaccurate; 

c) obtaining said other information employed to 
generate said printed error correction code; 

45 d) attempting to regenerate said error correc- 

tion code from said obtained other information; 

e) determining that the obtained other informa- 
tion is inaccurate; 

f) employing said obtained error correction 
so code and said obtained other information to 

regenerated a correct error correction code for 
said other information; and, 

g) employing said regenerated correct error 
correction code to verify the validity 

55 of said postage evidencing information. 

5. A method for verifying postage evidencing informa- 
tion printed on a mail piece, comprising the steps 
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of: 

a) generating an error correction code from at 
least a portion of addressee information printed 
on said mail piece; and, 

b) employing said generated error correction 
code to verify the validity of said postage evi- 
dencing information. 

6. A method for generating a mail piece comprising 
the steps of: 

a) generating an error correction code for at 
least a portion of the destination address; 

b) generating address structure information for 
said destination address; and, 

c) imprinting said error correction code and 
address structure information on said mail 
piece. 

7. A method of as defined in CLAIM 6 further compris- 
ing the step of imprinting said destination address 
on said mail piece. 

8. A method as defined in CLAIM 6 wherein said error 
correction code and said address structure informa- 
tion are imprinted on said mail piece in bar code for- 
mat. 

9. A method as defined in CLAIM 6 wherein said 
address structure information includes at least one 
of: the number of characters in a line, mail piece 
coordinates of the address block on the mail piece, 
font type, number of lines in the address and 
number of words in each line and total number of 
characters in the address block. 

10. A method for verifying postage evidencing informa- 
tion printed on a mail piece, comprising the steps 
of: 

a) obtaining an error correction code printed on 
a mail piece for other information printed on a 
mail piece; 

b) determining that the obtained error correc- 
tion code is inaccurate; 

c) obtaining said other information employed to 
generate said printed error correction code; 

d) regenerating said error correction code from 
said obtained other information; and, 

e) employing said regenerated correct error 
code to verify the validity of said postage evi- 
dencing information. 

11. A method for generating postage evidencing infor- 
mation comprising the steps of: 

a) generating an error correction code for at 



least a portion of destination address; 

b) generating address structure information for 
said destination address; 

c) imprinting said error correction code and 
5 address structure information on said mail 

piece; and, 

d) generating a digital token employing said 
error correction code and said address struc- 
ture information. 

10 

12. A method of as defined in CLAIM 11 further com- 
prising the step of imprinting said destination 
address on said mail piece. 

is 13. A method as defined in CLAIM 11 wherein said 
error correction code and said address structure 
information are imprinted on said mail piece in bar 
code format. 

20 14. A method as defined in CLAIM 1 1 wherein said 
address structure information includes at least one 
of the number of: characters in a line, coordinates 
of the address block on the mail piece, font type, 
number of lines in the address, number of words in 

25 each line and total number of characters in the 
address block. 

15. A method for generating authentication and data 
integrity information comprising the steps of: 

30 

a) generating an error correction code for infor- 
mation in a document; and, 

b) generating a digital token employing said 
error correction code. 

35 

16. A method for verifying authentication and integrity 
information printed on a document, comprising the 
steps of:: 

40 a) obtaining an error correction code printed on 

said document; and, 

b) employing said obtained error correction 
code to verify the validity of said evidencing 
information. 

45 

17. A method for generating authentication and integ- 
rity information comprising the steps of: 

a) generating an error correction code for infor- 
50 mation printed on a document; 

b) generating document structure information 
for said information printed on said document; 

c) imprinting said error correction code and 
document structure information on said docu- 

55 ment; and, 

d) generating a digital token employing said 
error correction code and said address struc- 
ture information. 
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18. A method as defined in CLAIM 17 wherein said 
document structure information, includes at least 
one of: the number of characters in a line, font type, 
number of lines in said destination address, number 

of words in each line and total number of characters s 
in the document. 

19. A method for facilitating the reading of destination 
address information on a mail piece comprising the 
steps of: 10 

a) generating address structure information for 
said destination address; and, 

b) imprinting said address structure information 

on said mail piece. is 

20. A method as defined in CLAIM 19 wherein said 
address structure information is imprinted on said 
mail piece in bar code format. 

20 

21. A method as defined in CLAIM 20 wherein said 
address structure information includes at least one 
of: the number of characters in a line, font type, 
number of lines in said destination address, number 

of words in each line and total number of characters 25 
in the document. 
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FIG. 6 
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FIG. 7 
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